Free tool — no signup
Free IP address validator
Paste an IPv4 or IPv6 address. You get whether it's syntactically valid, its canonical form, and what kind of address it is — public, private, loopback, reserved, bogon. Geolocation and proxy/VPN detection need licensed data we haven't shipped, so they're marked not-run, not faked.
Try a public vs a private address — or .
SampleA real response for this input — press Verify to run it live.
Checked
Not claimed — we won't fake it
What the free check covers
Everything it checks — and everything it won't fake.
Checked
Runs on every result above.
Whether the string parses as valid IPv4 or IPv6 — done by an actual address parser, not a brittle regex that misses edge cases.
Which IANA special range the address falls in: public, private (RFC 1918), loopback, link-local, multicast, reserved, documentation, shared, unique-local, and the bogon/unallocated cases.
Not claimed
Marked not-run in the result, never guessed.
Country, region, city. That needs a licensed geolocation database, which hasn't shipped — so it's marked not-run rather than approximated.
The autonomous system — the network or operator the address belongs to.
Whether it's a server address rather than a residential one — a common fraud signal, and honestly not one we run yet.
Anonymity-network detection. The intelligence layer behind it needs real licensed data; until that ships it stays not-run, not invented.
Abuse history or blocklist presence.
What makes an IP address valid
"Looks about right" is where regexes stop. A real parser returns the canonical spelling, so equal addresses compare equal.
IPv4
8.8.8.8
Four numbers 0–255, dot separated. Out-of-range octets are caught, not waved through.
IPv6
2606:4700:4700::1111
Eight hex groups, colon separated. Zero-run compression and embedded-IPv4 forms parsed properly.
Both classify as public, version 4 and 6 — that parse happens before anything is classified.
Public, private, reserved — what the classification tells you
Not every valid IP is one a real user connects from. Seeing one of these as a source IP on a public signup is a signal worth acting on.
private
192.168.1.1
Only exists inside local networks.
loopback
127.0.0.1
The machine talking to itself.
reserved
240.0.0.1
Space that should never appear as a public source — a classic spoofing tell.
Each label above is the exact `classification` this tool returns for that address, captured 9 August 2026. Free, today, with no licensed data behind it at all.
Format is the first layer, not the fraud layer
Validating and classifying an address is honest, cheap and genuinely useful — but it isn't IP intelligence.
- Format & versionParsed, range-checked and canonicalised runs here
- ClassificationPublic, private, loopback, reserved, documentation runs here
- Geolocation, ASN, hosting, proxy/VPN/TorNeeds licensed data not run
We'd rather ship the layer we can stand behind than paint a geolocation guess as a fact.
Questions
Is the IP address validator free?
Yes — no signup, no card, with an hourly per-visitor limit. It runs the same zero-cost checks the free API tier runs. Because it's pure arithmetic on the address, there's no data cost behind it at all.
Does it work for IPv6?
Yes. It parses and classifies both IPv4 and IPv6, handles zero-compression and embedded-IPv4 forms, and returns the canonical (RFC 5952) spelling for v6 addresses.
Can it tell me where an IP is located?
Not yet. Geolocation needs a licensed database, so country/region/city are marked not-run rather than approximated. What it can tell you today is whether the address is valid and what kind of address it is — public, private, bogon and so on.
What is a bogon IP?
An address from a range that should never appear as a public source — unallocated or reserved space. Seeing a bogon as the source of a real request is a spoofing or misconfiguration signal, which is why the classifier calls it out.
How do I check whether a string is a valid IP in code?
One POST to /v1/verify/ip with a bearer key returns valid, version, the normalized form, classification, is_public and is_bogon — plus the checks lists. If you'd rather do the format check inline, any language's standard library has an IP parser; the API adds the classification on top. Reference at boundstone.io/docs.
Need to classify source IPs at signup, or in bulk?
The same checks, one HTTP call — with checks.performed / not_performed on every response, so your code knows what a verdict was based on.
curl -X POST https://api.boundstone.io/v1/verify/ip \
-H "authorization: Bearer bs_live_YOUR_KEY" \
-H "content-type: application/json" \
-d '{"ip":"8.8.8.8"}'
# → { valid, version, normalized, classification,
# is_public, is_bogon, checks: { performed, not_performed } }
Early access — free tier is 250 credits/month, forever
The API is live — start free without waiting. This list gets benchmark № 001 the day it publishes. One email. We validate emails for a living — we're not going to spam yours.